CVE-2020-8260

KEV

Ivanti Pulse Connect Secure Code Execution Vulnerability

Vendor / Project: Ivanti
Product: Pulse Connect Secure
Date added: Nov 3, 2021
Due date: May 3, 2022
Known ransomware use: Unknown
CWEs: CWE-434

Description

Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.

Required action

Apply updates per vendor instructions.

Notes

Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2020-8260